20180914_PHISHING_SCAM_1

Received: from MBX05D-ORD1.mex08.mlsrvr.com (172.29.9.24) by
 MBX05C-ORD1.mex08.mlsrvr.com (172.29.9.23) with Microsoft SMTP Server (TLS)
 id 15.0.1367.3 via Mailbox Transport; Fri, 14 Sep 2018 14:20:11 -0500
Received: from MBX08D-ORD1.mex08.mlsrvr.com (172.29.9.33) by
 MBX05D-ORD1.mex08.mlsrvr.com (172.29.9.24) with Microsoft SMTP Server (TLS)
 id 15.0.1367.3; Fri, 14 Sep 2018 14:19:59 -0500
Received: from gate.forward.smtp.ord1d.emailsrvr.com (161.47.34.7) by
 MBX08D-ORD1.mex08.mlsrvr.com (172.29.9.33) with Microsoft SMTP Server (TLS)
 id 15.0.1367.3 via Frontend Transport; Fri, 14 Sep 2018 14:20:00 -0500
Return-Path: <jenymbz1@mesquitegroup.com>
X-Spam-Threshold: 95
X-Spam-Score: 0
X-Spam-Flag: NO
X-Virus-Scanned: OK
X-Orig-To: REMOVED
X-Originating-Ip: [192.185.145.23]
Authentication-Results: smtp27.gate.ord1d.rsapps.net; iprev=pass policy.iprev="192.185.145.23"; spf=temperror smtp.mailfrom="jenymbz1@mesquitegroup.com" smtp.helo="gateway33.websitewelcome.com"; dkim=fail (signing key too small) header.d=mesquitegroup.com; dmarc=none (p=nil; dis=none) header.from=mesquitegroup.com
X-Suspicious-Flag: YES
X-Classification-ID: 19fee96c-b853-11e8-a337-5254003773d7-1-1
Received: from [192.185.145.23] ([192.185.145.23:47197] helo=gateway33.websitewelcome.com)
	by smtp27.gate.ord1d.rsapps.net (envelope-from <jenymbz1@mesquitegroup.com>)
	(ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384)
	id 9E/92-16068-1C90C9B5; Fri, 14 Sep 2018 15:19:59 -0400
Received: from cm12.websitewelcome.com (cm12.websitewelcome.com [100.42.49.8])
	by gateway33.websitewelcome.com (Postfix) with ESMTP id 2577F18139
	for REMOVED; Fri, 14 Sep 2018 14:19:29 -0500 (CDT)
Received: from box5558.bluehost.com ([162.241.218.112])
	by cmsmtp with SMTP
	id 0tcMgMxWxSjJA0tccgyq1S; Fri, 14 Sep 2018 14:19:28 -0500
X-Authority-Reason: nr=8
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=mesquitegroup.com; s=default; h=Content-Type:MIME-Version:Message-Id:Date:
	Subject:Reply-To:To:From:Sender:Cc:Content-Transfer-Encoding:Content-ID:
	Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc
	:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:
	List-Subscribe:List-Post:List-Owner:List-Archive;
	bh=fDbVpRJ1NpVMucmP6wnjaS9hl+4bs5JXdcacOVnUSQM=; b=oLFYWsScEicuqzALGURLp8AjSa
	/skdRRejenr8OiZm4dYuZ4DAa2U3aceNJnTUEBxYiM7qw2g4gnUzsS0iDopTyQX/RDEGShjmJshnJ
	nldthW3jCXveDxez2jAgwgK9Z;
Received: from [37.211.161.164] (port=37916 helo=mail.mesquitegroup.com)
	by box5558.bluehost.com with esmtpa (Exim 4.91)
	(envelope-from <jenymbz1@mesquitegroup.com>)
	id 1g0tcM-000AIx-5L
	for REMOVED; Fri, 14 Sep 2018 14:19:02 -0500
From: "jenymbz1" <jenymbz1@mesquitegroup.com>
To: REMOVED
Reply-To: "jenymbz1" <jenymbz1v@yahoo.com>
Subject:
Date: Fri, 14 Sep 2018 19:21:37 +0000
Message-ID: <134965h4g913$ea3301rr$h6as10c0$@mesquitegroup.com>
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 16.0
Thread-Index: eS53dWFjLitoMnFtdW13PTAzZDB5KA==
Content-Language: en-us
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - box5558.bluehost.com
X-AntiAbuse: Original Domain - REMOVED
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - mesquitegroup.com
X-BWhitelist: no
X-Source-IP: 37.211.161.164
X-Source-L: No
X-Exim-ID: 1g0tcM-000AIx-5L
X-Source:
X-Source-Args:
X-Source-Dir:
X-Source-Sender: (mail.mesquitegroup.com) [37.211.161.164]:37916
X-Source-Auth: brandon@mesquitegroup.com
X-Email-Count: 200
X-Source-Cap: bWVzcXVpdDY7bWVzcXVpdDY7Ym94NTU1OC5ibHVlaG9zdC5jb20=
X-Local-Domain: yes
X-MS-Exchange-Organization-Network-Message-Id: 407c1f5d-32e8-48a3-d1fa-08d61a771077
X-MS-Exchange-Organization-AVStamp-Mailbox: SMEXzs^g;1450300;0;This mail has
 been scanned by Trend Micro ScanMail for Microsoft Exchange;
X-MS-Exchange-Organization-SCL: 0
X-MS-Exchange-Organization-AuthSource: MBX08D-ORD1.mex08.mlsrvr.com
X-MS-Exchange-Organization-AuthAs: Anonymous
Content-type: multipart/alternative;
	boundary="B_3619931226_1118890166"

> This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

--B_3619931226_1118890166
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: 7bit

Hi William







https://goo.gl/BUQ1Ln














--B_3619931226_1118890166
Content-type: text/html;
	charset="UTF-8"
Content-transfer-encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsof=
t-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" xmlns:m=
=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org=
/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0cm;
	margin-bottom:.0001pt;
	font-size:11.0pt;
	font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
	{mso-style-priority:99;
	color:#0563C1;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{mso-style-priority:99;
	color:#954F72;
	text-decoration:underline;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri","sans-serif";
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri","sans-serif";}
@page WordSection1
	{size:612.0pt 792.0pt;
	margin:2.0cm 42.5pt 2.0cm 3.0cm;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma">Hi W=
illiam<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><a h=
ref=3D"https://goo.gl/BUQ1Ln">https://goo.gl/BUQ1Ln</a><o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.1pt;font-family:Tahoma"><o:p=
>&nbsp;</o:p></span></p>
</div>
</body>
</html>


--B_3619931226_1118890166--